POCAll data is simulated. No real GitHub, npm or database calls.

This is the Achilles proof of concept

It walks through the real workflow end to end, but every external dependency is replaced by a mock served from Next.js route handlers.

  • GitHub OAuth & JWT

    The consent screen is simulated. Tokens are unsigned look-alikes in an httpOnly cookie.

  • GitHub repositories

    Repos and package.json files come from the test-packageJson-path seed set.

  • npm registry

    A frozen snapshot of ~150 packages powers the 4-level dependency crawl.

  • Advisory database

    GHSA/CVE records are a static sample. Don't use them for real security decisions.

  • MongoDB

    Reports live in server memory, per session. Restarting the server resets them.

AchillesPOC

npm dependency vulnerability scanner

Find the weak heel in your dependency tree.

Connect GitHub, pick a project and Achilles crawls its dependencies four levels deep, flags every package matching a known advisory, and shows the exact chain that pulls it in.

Connect with GitHubMOCK

Simulated OAuth. No GitHub account needed.

  1. 01Pick a repositoryPersonal or contributor repos from your GitHub.
  2. 02Choose package.jsonMonorepos? Pick which manifest to analyze.
  3. 03Watch the crawl4 levels of dependencies, checked live against advisories.
  4. 04Get a reportSeverity, vulnerable chains, CWEs and the fix to apply.